Network Traffic Analysis with tcpdump

What is tcpdump?

tcpdump is a command-line packet analyzer. While graphical tools like Wireshark are excellent for detailed analysis on a desktop, tcpdump is essential for DevOps engineers because it can run on any remote server, inside a container, or in automated scripts where a GUI is not available. It gives you a direct, unfiltered view of the network traffic flowing through your machine.

To get a better understanding of what tcpdump is and when you'd use it, let's start with a short reading.

Installation and Setup

tcpdump is likely already installed on your Linux system, but if not, you can install it easily. Because it needs to access network hardware at a low level, tcpdump requires root privileges to run. You will need to prefix all tcpdump commands with sudo.

Your First Packet Capture

Before you can capture traffic, you need to know which network interface to listen on. You can list the available interfaces with the -D flag.

sudo tcpdump -D

You'll see a numbered list of interfaces like eth0, lo (the loopback interface), and a special one called any that captures from all interfaces.

Now, let's start a basic capture. We'll use a few essential flags:

• -i <interface>: Specifies the interface to listen on (e.g., -i eth0).
• -c <count>: Stops after capturing a specific count of packets. This is useful to prevent an endless stream of output.
• -n: Disables IP address-to-hostname resolution.
• -nn: Disables both hostname and port-to-service name resolution (e.g., shows 80 instead of http). This is highly recommended as it's faster and avoids generating extra DNS traffic during your capture.

Let's capture 5 packets on your primary network interface (e.g., eth0 or ens33—use the one from the -D list that isn't lo).

# Replace 'eth0' with your actual interface name
sudo tcpdump -i eth0 -c 5 -nn

You'll see a few lines of output fly by. If there is no traffic, you can generate some by running ping 8.8.8.8 in another terminal. Press Ctrl+C to stop the capture if you didn't use the -c flag.

Understanding the Output

The output of tcpdump can look cryptic at first, but it follows a standard format. Let's break it down.

Here's a quick summary of a typical line:
13:02:14.911808 IP 192.168.1.10.39366 > 54.204.39.132.80: Flags [P.], ... length 112

• Timestamp: 13:02:14.911808
• Protocol: IP (Internet Protocol)
• Source: 192.168.1.10.39366 (IP address and port)
• Destination: 54.204.39.132.80 (IP address and port)
• TCP Flags: [P.] (Indicates the type of TCP packet, e.g., PUSH, ACK)
• Length: length 112 (The size of the packet's payload in bytes)

Filtering: The Key to Meaningful Analysis

A busy server can generate thousands of packets per second. Capturing everything is rarely useful. The real power of tcpdump comes from its filtering engine, which lets you capture only the traffic you care about.

Filters are made up of expressions. The most common ones are:

• host <ip_or_hostname>: Captures traffic to or from a specific host.
• net <network/cidr>: Captures traffic from or to an entire network range.
• port <number>: Captures traffic using a specific source or destination port.
• src or dst: Qualifiers to specify whether you're filtering on the source or destination (e.g., src host 1.2.3.4).
• tcp, udp, icmp: Protocol filters.

You can combine these with logical operators: and (&&), or (||), and not (!). Use parentheses () to group expressions. If you use parentheses, you must wrap the entire filter expression in quotes.

Let's study some examples.

Practice with Filters

1. Capture ping traffic: ping uses the ICMP protocol. Let's capture only that. In one terminal, start this capture:

   sudo tcpdump -i eth0 -nn icmp
   

   In a second terminal, ping a host:

   ping -c 3 google.com
   

   You will see only the ICMP echo requests and replies in your tcpdump window.

2. Capture SSH traffic: Let's see traffic to a specific port.

   # Capture traffic where the source or destination port is 22 (SSH)
   sudo tcpdump -i eth0 -nn -c 10 port 22
   

   If you are connected via SSH, you will see your own traffic.

3. Combine filters: Capture only HTTP traffic from a specific IP.

   # Capture TCP traffic on port 80 coming from the source host 192.0.2.10
   sudo tcpdump -i eth0 -nn 'tcp and port 80 and src host 192.0.2.10'
   

sudo tcpdump -i eth0 -nn 'src port 80 and dst host 203.0.113.55'

Saving Captures and Reading from Files

Analyzing traffic in real-time is often difficult. A much better workflow is to capture traffic to a file and analyze it later. These files are saved in the .pcap (packet capture) format, which can also be opened by tools like Wireshark.

• -w <filename.pcap>: Writes the raw packets to a file.
• -r <filename.pcap>: Reads packets from a file.

Workflow:

1. Capture to a file:

   # Capture 1000 packets on port 443 (HTTPS) and save to a file
   sudo tcpdump -i eth0 -nn -c 1000 -w https_traffic.pcap port 443
   

   Notice that no packets are printed to the screen.

2. Analyze from the file: You can now analyze this capture offline, even on a different machine. The best part is that you can apply filters when reading the file.

   # Read the file and show all packets
   tcpdump -nn -r https_traffic.pcap
   
   # Read the same file, but filter for a specific host
   tcpdump -nn -r https_traffic.pcap host 52.94.236.48
   

Basic Analysis: Looking Inside the Packets

So far, we've only looked at packet headers. To see the actual data payload, you can use:

• -A: Prints the payload in ASCII. This is great for unencrypted protocols like HTTP, SMTP, or DNS.
• -X: Prints the payload in heX and ASCII.

Let's try to view some HTTP traffic. In one terminal, start this capture:

# The -A flag will show us the content of the packets
sudo tcpdump -i eth0 -nn -A port 80

In a second terminal, use curl to make a web request:

curl http://example.com

In your tcpdump output, you should now be able to see the plain-text HTTP GET request from your machine and the HTML response from the server. This is incredibly useful for debugging API calls or web service issues.

Conclusion

Mastering tcpdump is a significant step in becoming a proficient DevOps engineer. You've moved from observing that connections exist with ss to being able to intercept and inspect the raw data flowing between applications.

Key Takeaways:

• tcpdump is a command-line tool for capturing and analyzing network packets, essential for remote server troubleshooting.
• Always run tcpdump with sudo and use the -nn flags to prevent unwanted name resolution.
• Use filters (host, port, proto) to isolate the exact traffic you need to analyze. This is the most critical skill for using tcpdump effectively.
• For offline analysis, save captures to a .pcap file with -w and read them with -r. You can apply new filters every time you read the file.
• Use the -A flag to inspect the payload of unencrypted protocols like HTTP.

This lesson concludes our module on networking fundamentals. You've learned about the OSI model, IP addressing, TCP vs. UDP, and how to use essential tools like ping, traceroute, ss, and now tcpdump.

In our next lesson, we will begin the Advanced Networking and Core Services module. We'll start by learning how to configure basic network interface settings, such as IP addresses and netmasks, on a Linux system. This will move us from observing the network to actively configuring it.